Executive brief
Kirby is a popular open-source content management system. A path traversal vulnerability in its media handling component allows attackers to access image files and other media assets from sibling directories adjacent to the main site root, such as staging sites or backups stored on the same server. An attacker can read or delete sensitive files in these sibling directories if they contain prepared thumbnail configuration files, potentially leading to information disclosure from internal sites.
Technical details
The vulnerability is a path traversal (CWE-22) in Kirby's media handler that processes thumbnail generation requests. The media handler uses filesystem containment checks in the `Kirby\Filesystem\Dir::realpath()` and `Kirby\Filesystem\F::realpath()` functions to prevent directory escape attacks, but these checks fail to enforce proper directory boundary validation. Specifically, the containment logic accepts sibling directories that share the same name prefix as the target directory (e.g., `/var/www/site2` bypasses the check for `/var/www/site`), allowing traversal via path manipulation. The attack requires the presence of a prepared thumbnail job file (.json metadata) in the target sibling directory and read access to that directory from PHP; no authentication or user interaction is required. An attacker can access and read media files or delete job files from staging sites, backups, and other internal sites co-hosted on the same server. Patches were released in Kirby 4.9.5 and 5.5.2, which enforce exact-match or DIRECTORY_SEPARATOR-boundary validation in containment helpers and block paths containing `../` sequences in the Asset class.
Affected products
- Kirby Kirby CMS < 4.9.5, >= 5.0.0 and < 5.5.2
Timeline
- 2026-07-15: disclosed
- 2026-09-02: patched: Kirby 4.9.5 and 5.5.2 released